Facebook apparently has not learned its lessons from last year's Beacon fiasco. The BBC is reporting that personal details can still be stolen by web applications developed by people with bad intentions.

A chain is only as strong as its weakest link and in this case, Facebook's weakest link is also the the thing that attracts up to 70 million users.

I don't think Facebook can afford to maintain this privacy/vulnerability dichotomy for too much longer. Before rolling out "hip" features like Instant Messaging, it should secure its network first.